#StopRansomware: Gunra Ransomware

Public source report. This item is not matched to your stack and does not establish whether you are affected.

• NewsCISA advisory

  #StopRansomware: Gunra Ransomware

  CVE-2024-55591 · CVE-2025-24472

  Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid. This advisory provides technical details of the activity, as well as tailored detection and mitigation guidance to protect at-risk organizations from Gunra.

  Published 5 Aug 2026 · Source checked 4 Nov 2026, 16:40 UTC · Read the advisory at cisa.gov

  Loading voting…